This introductory-level course is aimed at a broad audience - anyone who is interested in learning about the Incident Response Life Cycle and how to analyze, contain, and recover from a security incident. This is the second course in the Incident Response series, taking students through the critical processes that occur once a security event has been elevated to the status of a confirmed security incident.
The goals of this 3-day course are to have students analyze log and sensor data, network traffic, host-based artifacts, emails, and contextual data for evidence related to the attack vectors and scope of a breach, using FIRST CVSS 4.0 and other tools. Once this analysis is complete, students will use playbooks and industry-recognized resources, such as the MITRE ATT&CK matrix, to determine the appropriate follow-on actions for containment and recovery.
Learning Objectives
- Identify the types of data relevant to information security events
- Analyze host-based artifacts for the presence of anomalous activity
- Assess log and sensor data for detection of anomalous activity
- Assess contextual data sources for detection of anomalous activity
- Analyze email traffic for the presence of anomalous activity
- Analyze network traffic for the presence of anomalous activity
- Apply playbooks to contain and mitigate threats
- Recommend actions for containment and recovery using the Mitre ATT&CK matrix and detection use cases
- Simulate best practices for containment, analysis, and recovery in an incident response scenario
Framework Connections
Feedback
If you would like to provide feedback for this course, please e-mail the NICCS SO at NICCS@hq.dhs.gov.